Last updated: October 31, 2026
For years, Visa watched merchants through two separate lenses: one program for disputes, another for fraud. A merchant could sit just under both limits and never get flagged. That’s over. Visa VAMP, the Visa Acquirer Monitoring Program, merged those views into a single ratio, added card testing to the watch list, and in April 2026 lowered the bar for merchants in most regions.
If you sell online and accept Visa, this program now sets the line your acquirer cares about most. It also puts pressure on acquirers themselves, which is why some are asking merchants about dispute levels that would have been ignored two years ago.
This guide explains how VAMP works, step by step. We’ll cover the formula, the thresholds and timeline, what gets excluded, how enumeration (card testing) monitoring works, and what fees apply. Then we’ll lay out a practical plan for merchants. Midcove users run card-not-present volume through NMI, Authorize.Net, Stripe, and PayPal, so we’ll also note which parts of the response depend on your own tools and which depend on your processor.
What is Visa VAMP? The Visa Acquirer Monitoring Program is Visa’s single global program for card-not-present fraud and disputes, effective in 2025. It replaced the separate dispute (VDMP) and fraud (VFMP) programs, measuring fraud reports plus disputes against settled transactions, and separately monitoring card testing.
Table of Contents
What VAMP replaced and why
Before 2025, Visa ran the Visa Dispute Monitoring Program (VDMP) and the Visa Fraud Monitoring Program (VFMP), plus related acquirer-level programs. Each had its own thresholds and calendar. Visa’s own introduction to VAMP describes the goal as one consolidated program that looks at fraud and disputes together.
The program monitors at three levels:
- Acquirer portfolio: each acquirer’s overall fraud and dispute ratio across all its merchants.
- Individual merchant: merchants whose own ratio crosses the Excessive line.
- Enumeration: merchants with heavy card testing activity.
The acquirer level is the quiet driver. When an acquirer’s whole portfolio is measured, it has a reason to press every merchant with an above-average ratio, not just the ones over the merchant limit.
The Visa VAMP ratio formula
VAMP uses counts, not dollars:
VAMP ratio = (TC40 fraud reports + TC15 disputes) ÷ TC05 settled card-not-present transactions
Each term is a Visa transaction code. A TC40 is a fraud report from the issuer, filed when a cardholder says a charge was fraud, even if no dispute follows. A TC15 is a dispute. A TC05 is a settled sale. Everything is counted in the same calendar month.
The double count
One fraudulent sale can create both a TC40 and a TC15. Under VAMP, both count. So a fraud problem weighs roughly twice as heavily as the old dispute-only ratio suggested. Merchants who used to watch only chargebacks are often surprised by how high their VAMP number runs.
A worked example
Picture a Toronto chocolate and gift box shop. In a normal month it settles 60,000 Visa online orders and gets 480 disputes and 520 fraud reports. That’s 1,000 events, a ratio of 1.67%, but below the 1,500 minimum count, so it isn’t flagged as an Excessive merchant. Its acquirer may still call, because 1.67% drags the portfolio.
Then February arrives. Valentine’s Day pushes volume to 140,000 orders, and a card testing wave lifts fraud. The month brings 1,300 disputes and 900 fraud reports: 2,200 events, a ratio of 1.57%. Now both conditions are met. The shop is over the line in its busiest month.
Visa VAMP thresholds and timeline
Visa rolled out Visa VAMP in stages. The dates below come from Visa’s published materials and processor summaries; your acquirer’s notices take priority for your account.
| Date | What happened |
|---|---|
| April 1, 2025 | VAMP takes effect, consolidating earlier programs; advisory period begins |
| June 1, 2025 | Updated thresholds and minimum counts apply |
| September 30, 2025 | Advisory period ends |
| October 1, 2025 | Enforcement begins at the Excessive level |
| April 1, 2026 | Merchant Excessive threshold drops from 2.2% to 1.5% in the US, Canada, Europe, and Asia Pacific |
Current thresholds
| Level | Ratio | Minimum monthly count |
|---|---|---|
| Merchant, Excessive (US, Canada, Europe, Asia Pacific, Latin America) | 1.5% or higher | 1,500 fraud reports + disputes |
| Merchant, Excessive (CEMEA) | 2.2% or higher | Lower count and dollar floors apply; confirm with acquirer |
| Acquirer, Above Standard | 0.5% or higher | 1,500 |
| Acquirer, Excessive | 0.7% or higher | 1,500 |
| Enumeration, Excessive | 20% of authorizations | 300,000 enumerated transactions |
You’ll find guides online claiming the merchant threshold is falling to 0.9%. We couldn’t find that figure in Visa’s published VAMP materials, so treat it with caution until your acquirer confirms otherwise. Processors also report that Visa is adding regional programs, such as a merchant-level risk program (MERP) in Asia Pacific from October 2026, so check what applies where you sell.
What VAMP excludes
Visa built in ways to keep resolved cases out of the count. That’s a deliberate push toward fixing problems before they become disputes.
- Pre-dispute resolutions. Disputes resolved through Visa’s pre-dispute tools, such as Rapid Dispute Resolution and Order Insight via Verifi, are excluded from the count.
- Compelling Evidence 3.0. Fraud reports on transactions that qualify under CE 3.0 are excluded. CE 3.0 lets you show a disputed card was used in earlier undisputed purchases with matching device or account data.
Timing matters. Resolutions generally need to land in time to affect that month’s count, and processors differ in how they handle edge cases. Note also what isn’t excluded: winning a dispute doesn’t remove it. A refund issued after the dispute is filed doesn’t either.
Visa explains its reasoning in a later update, Evolving the Visa Acquirer Monitoring Program, which credits investment in pre-dispute tools and CE 3.0 through these exclusions.
Enumeration: card testing under VAMP
Enumeration is the network’s word for card testing: bots running large numbers of stolen or guessed card numbers through your checkout to see which ones work. Visa uses a machine learning model to label enumerated authorizations. Both approvals and declines count once they reach the processor.
The enumeration ratio is enumerated transactions divided by total authorizations. A merchant is flagged when it has at least 300,000 enumerated transactions and a ratio of 20% or more in a month. That sounds high, but a single bot attack on an unprotected donation page or low-price digital product can produce hundreds of thousands of attempts overnight.
Consider a seller of game credits with a $2 minimum. On a normal day it processes 8,000 authorizations. One weekend, bots hit its checkout with 350,000 test attempts. Most decline, which is exactly the point for the attacker. It doesn’t matter to Visa that the merchant lost no money on goods. The pattern counts.
How to stop enumeration
- Velocity limits by IP, device, email, and card BIN.
- A CAPTCHA or bot challenge on checkout and on any “add card” page.
- Minimum transaction amounts where the business allows it.
- Temporary lockouts after repeated failed attempts.
- Monitoring decline rates by hour, so a spike is caught in minutes, not days.
Stripe’s guide to preventing card testing is a useful practical reference, whichever gateway you use. Our guide to card testing attacks covers incident response in detail.
Fees and consequences
When a merchant is identified as Excessive, the acquirer can be assessed fees for each fraud report and dispute in that month. Industry summaries widely report $8 per item for Excessive merchants, which acquirers typically pass through. First-time identifications may get a grace period, depending on the program rules and your acquirer.
Under Visa VAMP, fees are rarely the biggest cost. The usual chain looks like this: a remediation plan request, closer monitoring, higher reserves, and if the ratio doesn’t come down, account termination. A terminated account can also make it harder to open a new one. For a business at 2,200 monthly events, $8 each is $17,600 a month, before any reserve change.
What merchants should do now
Here’s a plan that works whether you’re far from the line or close to it.
- Calculate your own VAMP ratio. Use counts, include fraud reports, and use same-month settled transactions. Do it for every MID separately. Our walkthrough of chargeback ratio monitoring shows the method.
- Ask your acquirer for TC40 data. You can’t manage fraud reports you can’t see. Ask how often they can share them.
- Enroll in pre-dispute tools. Ask which of Visa’s pre-dispute programs your MIDs can join, and what each case costs.
- Prepare for CE 3.0. Capture device ID, IP address, and account data on every order so qualifying fraud claims can be excluded.
- Close the card testing gap. Add velocity controls, lockouts, and bot challenges before the next attack, not after.
- Refund early. When a customer complains, a quick refund before a dispute is filed keeps it out of the count. A refund workflow that’s fast for support staff makes this easier.
- Fix descriptors and billing clarity. Unrecognized charges and forgotten subscriptions drive disputes that are easy to prevent.
- Plan for seasonal peaks. Ratios can jump in busy months when fraud rises with volume. Tighten controls ahead of them.
Where Midcove fits
Midcove’s fraud prevention tools let you block IPs, emails, phone numbers, and BINs, and on Growth and Enterprise plans apply an automatic 24-hour lockout after repeated failed attempts. These work alongside your gateway’s own fraud tools. Chargebacks from every MID land in one queue with deadline tracking and evidence upload. What Midcove doesn’t do: it isn’t enrolled in Visa’s pre-dispute programs on your behalf, and it can’t see TC40 data your processor doesn’t share. Those pieces run through your acquirer.
Key Takeaways
- Visa VAMP replaced VDMP and VFMP in 2025 with one program covering card-not-present fraud and disputes.
- The ratio is (TC40 fraud reports + TC15 disputes) ÷ settled transactions, counted in the same month; one fraud sale can count twice.
- Since April 1, 2026, the merchant Excessive threshold is 1.5% with at least 1,500 events in most regions.
- Enumeration is monitored separately: 300,000 enumerated transactions and a 20% ratio.
- Pre-dispute resolutions and CE 3.0-qualified fraud reports are excluded; won disputes are not.
- The best defense is early refunds, pre-dispute tools, CE 3.0 data capture, and strong card testing controls.
Frequently Asked Questions
What does VAMP stand for?
VAMP stands for Visa Acquirer Monitoring Program. Despite the name, it monitors merchants as well as acquirers. It’s Visa’s consolidated program for card-not-present fraud, disputes, and card testing, and it replaced the separate Visa Dispute Monitoring Program and Visa Fraud Monitoring Program.
When did Visa VAMP start?
VAMP took effect on April 1, 2025, with an advisory period that ended September 30, 2025. Updated thresholds applied from June 1, 2025, and enforcement at the Excessive level began October 1, 2025. The merchant threshold then tightened on April 1, 2026.
What is the VAMP threshold for merchants?
Since April 1, 2026, a merchant in the US, Canada, Europe, Asia Pacific, or Latin America is Excessive at a VAMP ratio of 1.5% or higher, with at least 1,500 fraud reports plus disputes in the month. CEMEA uses a 2.2% threshold with different minimums.
How is the VAMP ratio calculated?
Add the month’s TC40 fraud reports and TC15 disputes, then divide by the month’s settled card-not-present transactions. Use counts, not dollar amounts. A fraudulent sale that is both reported and disputed counts twice. Disputes resolved through qualifying pre-dispute tools and CE 3.0-qualified fraud reports are left out.
Do refunds count toward VAMP?
Refunds themselves aren’t part of the ratio. A refund issued before a dispute is filed can prevent that dispute from ever counting. A refund issued after a dispute is filed doesn’t remove it. A fraud report can still be filed on a refunded transaction, so refunds help with disputes more than with TC40s.
What is an enumeration attack?
An enumeration attack is card testing: bots submit large volumes of card numbers to see which ones work. Under VAMP, Visa flags merchants with at least 300,000 enumerated transactions and an enumeration ratio of 20% or more in a month. Declined attempts count too.
What are the VAMP fines for merchants?
Industry summaries report fees of about $8 per fraud report and dispute for merchants identified as Excessive, assessed to the acquirer and usually passed through. First identifications may get a grace period. Beyond fees, acquirers can demand remediation plans, raise reserves, or close accounts.
Is the VAMP threshold dropping to 0.9%?
Some articles claim a 0.9% merchant threshold, but we couldn’t find it in Visa’s published VAMP materials as of October 2026. The confirmed merchant Excessive level is 1.5% in most regions. Your acquirer may still set stricter internal limits, so ask what they use for your account.
Living with a 1.5% line
Visa VAMP changed the math for online merchants. Fraud reports and disputes now share one ratio, card testing has its own watch list, and the merchant line sits at 1.5% in most regions. Acquirers are measured too, so they’ll often act well before you reach it.
The good news is that the program rewards the right habits. Refund early, use pre-dispute tools, capture the data CE 3.0 needs, and shut down card testing quickly. Track your own ratio per MID every week instead of waiting for a monthly letter from your acquirer. Midcove can help with the fraud filters, lockouts, and one dispute queue across your gateways, while your acquirer handles network data and enrollment.
Keep your VAMP ratio under control
See how Midcove’s fraud filters, 24-hour lockouts, and cross-gateway chargeback queue support your VAMP response plan.